This change rewrites some of the code to add properties to an object....

src/objects.h

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1285 matching lines @@
   // Add a constant function property to a fast-case object.
   // This leaves a CONSTANT_TRANSITION in the old map, and
   // if it is called on a second object with this map, a
   // normal property is added instead, with a map transition.
   // This avoids the creation of many maps with the same constant
   // function, all orphaned.
   Object* AddConstantFunctionProperty(String* name,
                                       JSFunction* function,
                                       PropertyAttributes attributes);
 
-  // Replace a constant function property on a fast-case object.
-  Object* ReplaceConstantFunctionProperty(String* name,
-                                          Object* value);
+  Object* ReplaceSlowProperty(String* name,
+                              Object* value,
+                              PropertyAttributes attributes);
+
+  // Converts a descriptor of any other type to a real field,
+  // backed by the properties array.  Descriptors of visible
+  // types, such as CONSTANT_FUNCTION, keep their enumeration order.
+  // Converts the descriptor on the original object's map to a
+  // map transition, and the the new field is on the object's new map.
+  Object* ConvertDescriptorToFieldAndMapTransition(
+      String* name,
+      Object* new_value,
+      PropertyAttributes attributes);
+
+  // Converts a descriptor of any other type to a real field,
+  // backed by the properties array.  Descriptors of visible
+  // types, such as CONSTANT_FUNCTION, keep their enumeration order.
+  Object* ConvertDescriptorToField(String* name,
+                                   Object* new_value,
+                                   PropertyAttributes attributes);
 
   // Add a property to a fast-case object.
   Object* AddFastProperty(String* name,
                           Object* value,
                           PropertyAttributes attributes);
 
   // Add a property to a slow-case object.
   Object* AddSlowProperty(String* name,
                           Object* value,
                           PropertyAttributes attributes);
@@ skipping 51 matching lines @@
     int number_of_slow_unused_elements_;
   };
 
   void IncrementSpillStatistics(SpillInformation* info);
 #endif
   Object* SlowReverseLookup(Object* value);
 
   static const uint32_t kMaxGap = 1024;
   static const int kMaxFastElementsLength = 5000;
   static const int kMaxFastProperties = 8;
+  // When extending the backing storage for property values, we increase
+  // its size by more than the 1 entry necessary, so sequentially adding fields
+  // to the same object requires fewer allocations and copies.
+  static const int kFieldsAdded = 3;
 
   // Layout description.
   static const int kPropertiesOffset = HeapObject::kHeaderSize;
   static const int kElementsOffset = kPropertiesOffset + kPointerSize;
   static const int kHeaderSize = kElementsOffset + kPointerSize;
 
   Object* GetElementWithInterceptor(JSObject* receiver, uint32_t index);
 
  private:
   Object* SetElementWithInterceptor(uint32_t index, Object* value);
@@ skipping 165 matching lines @@
 
   // Accessors for fetching instance descriptor at descriptor number..
   inline String* GetKey(int descriptor_number);
   inline Object* GetValue(int descriptor_number);
   inline Smi* GetDetails(int descriptor_number);
 
   // Accessor for complete descriptor.
   inline void Get(int descriptor_number, Descriptor* desc);
   inline void Set(int descriptor_number, Descriptor* desc);
 
-  void ReplaceConstantFunction(int descriptor_number, JSFunction* value);
 
   // Copy the descriptor array, insert a new descriptor and optionally
   // remove map transitions.  If the descriptor is already present, it is
   // replaced.  If a replaced descriptor is a real property (not a transition
   // or null), its enumeration index is kept as is.
   // If adding a real property, map transitions must be removed.  If adding
   // a transition, they must not be removed.  All null descriptors are removed.
   Object* CopyInsert(Descriptor* descriptor, TransitionFlag transition_flag);
 
-  // Makes a copy of the descriptor array with the descriptor with key name
-  // removed.  If name is the empty string, the descriptor array is copied.
-  // Transitions are removed if TransitionFlag is REMOVE_TRANSITIONS.
-  // All null descriptors are removed.
-  Object* CopyRemove(TransitionFlag remove_transitions, String* name);
-
-  // Copy the descriptor array, replace the property index and attributes
-  // of the named property, but preserve its enumeration index.
-  Object* CopyReplace(String* name, int index, PropertyAttributes attributes);
-
-  // Copy the descriptor array, removing the property index and attributes
-  // of the named property.
-  Object* CopyRemove(String* name);
-
   // Remove all transitions.  Return  a copy of the array with all transitions
   // removed, or a Failure object if the new array could not be allocated.
   Object* RemoveTransitions();
 
   // Sort the instance descriptors by the hash codes of their keys.
   void Sort();
 
   // Search the instance descriptors for given name.
   inline int Search(String* name);
 
@@ skipping 2391 matching lines @@
     } else {
       value &= ~(1 << bit_position);
     }
     return value;
   }
 };
 
 } }  // namespace v8::internal
 
 #endif  // V8_OBJECTS_H_